300-715 practice questions 251–260

1. Question 251 · 355 in bank

   An administrator connects an HP printer to a dot1x enable port, but the printer is nor accessible. Which feature must the administrator enable to access the printer?

   • Achange of authorization
   • BMAC authentication bypass
   • CTACACS authentication
   • DRADIUS authentication

   Show answer

   Answer: B

   Next question

2. Question 252 · 355 in bank

   When configuring an authorization policy, an administrator cannot see specific Active Directory groups present in their domain to be used as a policy condition. However, other groups that are in the same domain are seen. What is causing this issue?

   • ACisco ISE's connection to the AD join point is failing.
   • BCisco ISE only sees the built-in groups, not user created ones.
   • CThe groups are not added to Cisco ISE under the AD join point.
   • DThe groups are present but need to be manually typed as conditions.

   Show answer

   Answer: C

   Next question

3. Question 253 · 355 in bank

   An engineer is implementing network access control using Cisco ISE and needs to separate the traffic based on the network device ID and use the IOS device sensor capability. Which probe must be used to accomplish this task?

   • ANetFlow probe
   • BHTTP probe
   • CRADIUS probe
   • Dnetwork scan probe

   Show answer

   Answer: C

   Explanation

   SISE Official Cert Guide, pg. 414-415 Device Sensor is a feature in a switch or controller that collects endpoint attributes locally and then sends those attributes to ISE within the RADIUS Accounting packets

   Source: Adapted from community discussion — tliz

   References

   • cisco.com documentation

   Next question

4. Question 254 · 355 in bank

   What is an advantage of using EAP-TLS over EAP-MS-CHAPv2 for client authentication?

   • AEAP-TLS uses a username and password for authentication to enhance security, while EAP-MS-CHAPv2 does not.
   • BEAP-TLS uses multiple forms of authentication, while EAP-MS-CHAPv2 only uses one.
   • CEAP-TLS uses a device certificate for authentication to enhance security, while EAP-MS-CHAPv2 does not.
   • DEAP-TLS secures the exchange of credentials, while EAP-MS-CHAPv2 does not.

   Show answer

   Answer: C

   Explanation

   Reference: https://www.securew2.com/blog/eap-tls-vs-peap-mschapv2-which-authentication-protocol-is-superior

   Next question

5. Question 255 · 355 in bank

   What must be configured on the WLC to configure Central Web Authentication using Cisco ISE and a WLC?

   • AUse the ip access-group webauth in command.
   • BUse the radius-server vsa send authentication command.
   • CSet the NAC State option to SNMP NAC.
   • DSet the NAC State option to RADIUS NAC.

   Show answer

   Answer: D

   References

   • Cisco documentation

   Next question

6. Question 256 · 355 in bank

   A network administrator is configuring authorization policies in Cisco ISE. There is a requirement to use AD group assignments to control access to network resources. After a recent power failure and Cisco ISE rebooting itself, the AD group assignments no longer work. What is the cause of this issue?

   • AThe AD join point is no longer connected.
   • BThe certificate checks are not being conducted.
   • CThe network devices ports are shut down.
   • DThe AD DNS response time is slow.

   Show answer

   Answer: A

   Next question

7. Question 257 · 355 in bank

   

   Refer to the exhibit. Which component must be configured to apply the SGACL?

   • Asecure server
   • Bhost
   • Cegress router
   • Dingress router

   Show answer

   Answer: C

   Explanation

   Hello guys after failing the exam I'm back here :) (that's funny isn't it? Well no..) BTW this question here need a real answer! "Cisco TrustSec access control is implemented using ingress tagging and egress enforcement" This means that in the ingress router we put the SGT TAG, the egress router will do the enforcement of the ACL outbound, so the router that we need to use for applying the ACL is the egress one. "At the egress point of the Cisco TrustSec domain, an egress device uses the source SGT and the security group number of the destination entity (the destination SG, or DGT) to determine which access policy to apply from the SGACL policy matrix." This link will clarify everything: https://www.cisco.com/c/en/us/td/docs/switches/lan/trustsec/configuration/guide/trustsec/arch_over.html search Ingress Tagging and Egress Enforcement with ctrl + f

   Source: Adapted from community discussion — XBfoundX

   References

   • Cisco documentation

   Next question

8. Question 258 · 355 in bank

   A laptop was stolen and a network engineer added it to the block list endpoint identity group. What must be done on a new Cisco ISE deployment to redirect the laptop and restrict access?

   • ASelect DROP under If Auth fail within the authentication policy.
   • BEnsure that access to port 8444 is allowed within the ACL.
   • CEnsure that access to port 8443 is allowed within the ACL.
   • DSelect DenyAccess within the authentication policy.

   Show answer

   Answer: B

   Explanation

   Employees do not access this portal directly, but are redirected to it. If employees lose their personal device or it is stolen, they can update its status in the My Devices portal, which adds it to the Blacklist endpoint identity group. This prevents others from using the device to obtain unauthorized network access. If anyone attempts to connect to the network using one of these devices, they are redirected to the Blacklist portal which informs them that the device is denied access to the network. https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/admin_guide/b_ise_admin_guide_20/m_ise_device_access.html

   Source: Adapted from community discussion — XBfoundX

   References

   • Cisco documentation
   • Cisco documentation

   Next question

9. Question 259 · 355 in bank

   When creating a policy within Cisco ISE for network access control, the administrator wants to allow different access restrictions based upon the wireless SSID to which the device is connecting. Which policy condition must be used in order to accomplish this?

   • ANetwork Access NetworkDeviceName CONTAINS <SSID Name>
   • BDEVICE Device Type CONTAINS <SSID Name>
   • CAirespace Airespace-Wlan-Id CONTAINS <SSID Name>
   • DRadius Called-Station-ID CONTAINS <SSID Name>

   Show answer

   Answer: D

   Explanation

   D is correct--The WLC can be configured to send the SSID name in the RADIUS Called-Station-ID attribute, which in turn can be used as a condition on ISE.

   Source: Adapted from community discussion — THEODORABLE

   References

   • Cisco documentation

   Next question

10. Question 260 · 355 in bank

    What is a requirement for Feed Service to work?

    • ATCP port 8080 must be opened between Cisco ISE and the feed server.
    • BCisco ISE has access to an internal server to download feed update.
    • CCisco ISE has a base license.
    • DCisco ISE has Internet access to download feed update.

    Show answer

    Answer: D

    Explanation

    Correct answer D. We are talking about posture feature and this feature utilized Feed server in order to maintain the most update policies for posture assesment(the most recent version for antivirus. https://content.cisco.com/chapter.sjs?uri=/searchable/chapter/content/en/us/td/docs/security/ise/1-4/admin_guide/b_ise_admin_guide_14/b_ise_admin_guide_14_chapter_0111.html.xml https://www.cisco.com/c/dam/en/us/td/docs/security/ise/feedserver/partner_portal_faq/Feed_Service_Partner_Portal_FAQs.pdf)

    Source: Adapted from community discussion — jcms700

    References

    • cisco.com documentation
    • Cisco documentation
    • Cisco documentation
    • cisco.com documentation
    • cisco.com documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

300-715 practice, question 251. 355 questions available.